Disaster recovery strategies for computer systems generally involve copying data stored at a primary site to a secondary site which is typically located some distance from the primary site. Copying between the primary and secondary copies may be performed either synchronously or asynchronously. Where copying is performed synchronously, each time an update is written to the primary copy, the update is also sent to the secondary site to be written to the secondary copy. Only after the secondary site informs the primary site that the secondary copy has been updated does the primary site acknowledge the update to the primary copy and stand ready to write the next update. Thus, updates are written to the primary and secondary copies in the same order. Where copying is performed asynchronously, multiple updates may be written to the primary copy and acknowledged before any updates are sent to the secondary site, as the primary copy is maintained independently from the secondary copy. The updates are sent periodically to the secondary site, typically as a set of writes referred to herein as a “color,” and are written to the secondary copy, not necessarily in the same order as they were written to the primary copy.
It is often desirable to preserve the order of writes in order to maintain data consistency between the primary and secondary copies. For example, given the following typical sequence of dependent writes for a data base update transaction:                1. execute a write to update the data base log indicating that a data base update is about to take place, then        2. execute a second write to update the data base, and finally        3. execute a third write to update the data base log indicating that the data base update has completed successfully,it is imperative that these dependent writes either all belong to the same color, or, if they cross a color boundary, that the earlier write(s) belong to the old color and the later write(s) belong to the new color.        
In one technique for maintaining colors, the primary site may store a copy of the data written to the primary copy, preserving the order of the writes within the color. However, since the amount of space available for maintaining the color is typically limited, it is often necessary to switch to a bit map mode where, instead of storing a copy of the data and the order in which the data are written, a bit map is maintained where each bit in the bit map corresponds to a different segment of primary storage, such as a disk sector. Thus, if data are written to a particular segment, it's corresponding bit in the bit map is set to indicate that the segment is “dirty.” In order to copy the writes belonging to the color to the secondary site, the bit map is consulted, and all dirty sectors are copied to the secondary site. However, in changing to bit map mode, the order of the writes within the color is lost and can no longer be maintained. Thus, there is no guarantee that dependent writes within a color will be written to the secondary site in the proper order, and the secondary site is effectively placed in an inconsistent state throughout the update process. If the primary site fails during this stage, the secondary site cannot be relied upon to take over, as it is not known to be consistent.